Oftentimes a computer network address, such as an Internet Protocol (IP) address, is associated with a particular geographic location or area. For example, a set of IP addresses may be administered by a particular regional authority, such as the American Registry for Internet Numbers (ARIN), which administers IP addresses for one or more countries. The regional authority can allow an Internet Service Provider (ISP) to use the set of IP addresses for customers of the ISP, such as cable Internet or Digital Subscriber Line (DSL) users. The set of IP addresses from which the ISP assigns a specific IP address to a user's computing device can be associated with a particular geographic location or area, such as a neighborhood, city, state, or country.
An online business that provides a service, such as online banking or email, can detect possible fraud or abuse for an account by identifying an access of the account from a subsequent computing device with a different IP address. The online business determines that the different IP address is not within the set of IP addresses associated with the particular geographic location or area from which a user has previously accessed the account. The online business also determines that the different IP address originates from a location or area that is geographically distant from the location or area from which the user previously accessed the account. The online business then provides the subsequent computing device with an additional challenge question, such as a question regarding something only the user should know (e.g., a name of the user's first pet or an identifier generated by an identifier generating device in the user's possession). If the online business receives a correct response from the subsequent computing device, then the online business provides the computing device with access to the service.